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Abstract. Attack-defense trees are used to describe security weaknesses 
of a system and possible countermeasures. In this paper, the connection 
between attack-defense trees and game theory is made explicit. We show 
that attack-defense trees and binary zero-sum two-player extensive form 
games have equivalent expressive power when considering satisfiability, 
in the sense that they can be converted into each other while preserving 
their outcome and their internal structure. 



1 Introduction 

Attack trees [T], as popularized by Bruce Schneier at the end of the 1990s, form 
an informal but powerful method to describe possible security weaknesses of a 
system. An attack tree basically consists of a description of an attacker's goal and 
its refinement into sub-goals. In case of a conjunctive refinement, all sub-goals 
have to be satisfied to satisfy the overall goal, while for a disjunctive refinement 
satisfying any of the sub-goals is sufficient to satisfy the overall goal. The non- 
refined nodes (i.e., the leaves of the tree) are basic attack actions from which 
complex attacks are composed. 

Due to their intuitive nature, attack trees prove to be very useful in under- 
standing a system's weaknesses in an informal and interdisciplinary context. 
The development of an attack tree for a specific system may start by building 
a small tree that is obviously incomplete and describes the attacks at a high 
level of abstraction, while allowing to refine these attacks and to add new at- 
tacks later as to make a more complete description. Over the last few years, 
attack trees have developed into an even more versatile tool. This is due to two 
developments. The first development consists of the formalization of the attack 
trees method [2] which provides an attack tree with a precise meaning. As a 
consequence, formal analysis techniques were designed |3I4] and computer tools 
were made commercially available [5 6J. 
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The second development comes from the insight that a more complete descrip- 
tion can be achieved by modeling the activities of a system's defender in addition 
to those of the attacker. Consequently, one can analyze which set of defenses is 
optimal from the perspective of, for instance, cost effectiveness. Several notions 
of protection trees or defense nodes have already been proposed in the litera- 
ture |7I8| . They mostly consist of adding one layer of defenses to the attack tree, 
thus ignoring the fact that in a dynamic system new attacks are mounted against 
these defenses and that, consequently, yet more defenses are brought into place. 
Such an alternating nature of attacks and defenses is captured in the notion of 
attack-defense trees [5]. In this recently developed extension of attack trees, the 
iterative structure of attacks and defenses can be visualized and evolutionary 
aspects can be modeled. 

These two developments, the formalization of attack trees and the introduction 
of defenses, imply that an attack-defense tree can be formally considered as 
a description of a game. The purpose of this paper is to make the connection 
between attack-defense trees and game theory explicit. We expect that the link 
between the relatively new field of attack modeling and the well-developed field 
of game theory can be exploited by making game theoretic analysis methods 
available to the attack modeling community. As a first step, we study the relation 
between attack-defense trees and games in terms of expressiveness. Rather than 
studying the graphical attack-defense tree language, we consider an algebraic 
representation of such trees, called attack-defense terms (ADTerms) [Hj, which 
allows for easier formal manipulation. 

The main contribution of this paper is to show that ADTerms with a satisfi- 
ability attribute are equivalent to two-player binary zero-sum extensive form 
games. Whenever we talk about games, we refer to a game in this class. We 
show equivalence by defining two mappings: one from games to ADTerms and 
one from ADTerms to games. Then, we interpret a strategy in the game as a 
basic assignment for the corresponding ADTerm and vice versa. Such a basic 
assignment expresses which attacks and defenses are in place. Equivalence then 
roughly means that for every winning strategy, there exists a basic assignment 
that yields a satisfiable term, and vice versa. Although the two formalisms have 
much in common, their equivalence is not immediate. Two notions in the domain 
of ADTerms have no direct correspondence in the world of games: conjunctive 
nodes and refinements. The mapping from ADTerms into games will have to 
solve this in a semantically correct way. 

This paper is structured as follows. We introduce attack-defense terms and two- 
player binary zero-sum extensive form games in Section [21 In Section [3] we define 
a mapping from games to attack-defense terms and prove that a player can win 
the game if and only if he is successful in the corresponding ADTerm. A reverse 
mapping is defined in Section 0J 

This paper includes an appendix, containing the proofs that could not be in- 
cluded in the main paper due to space restrictions. 
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2 Preliminaries 

2.1 Attack Defense Trees 

A limitation of attack trees is that they cannot capture the interaction between 
attacks carried out on a system and defenses put in place to fend off the attacks. 
To mitigate this problem and in order to be able to analyze an attack-defense 
scenario, attack-defense trees are introduced in [5]. Attack-defense trees may 
have two types of nodes: attack nodes and defense nodes, representing actions 
of two opposing players. The attacker and defender are modeled in a purely 
symmetric way. To avoid differentiating between attack-defense scenarios with 
an attack node as a root and a defense node as a root, the notions of propo- 
nent (denoted by p) and opponent (denoted by o) are introduced. The root of 
an attack-defense tree represents the main goal of the proponent. To be more 
precise, when the root is an attack node, the proponent is an attacker and the 
opponent is a defender, and vice versa. 

To formalize attack-defense trees we use attack-defense terms. Given a set S, 
we write S* for the set of all strings over S and e for the empty string. 

Definition 1. Attack-defense terms (ADTerms) are typed ground terms over a 
signature S — (S,F), where 

— S — {p,o} is a set of types (we denote — p = o and — o = J>), 



- F = {(vP) feeN ,(AP) fce N,(V^) fce N,(A^) feeN ,cP,c }UBPUB° is a set of func- 



Hons equipped with a mapping type : F — > S* x S , which expresses the type 
of each function as follows. For k G N, 



The elements of B p and B° are typed constants, which represent basic actions 
of the proponent and the opponent, respectively. The functions , A^ , V°. , A£ 
represent disjunctive (V) and conjunctive (A) refinement operators of arity k, 
for a proponent (p) and an opponent (o) , respectively. Whenever it is clear from 
the context, we omit the subscript k. The binary function c s ('counter'), where 
s G S, connects a term of the type s with a countermeasure. By Ts we denote the 
set of all ADTerms. We partition Ts into Tji (the set of terms of the proponent's 
type) and Tg. (the set of terms of the opponent's type). To denote the type of a 
term, we define a function r: Te — ► S by r(t) = s if t G T£.. 



Example 1. The ADTerm t = c p ( A p (E, F), V°(G)) G T p is graphically displayed 
in Fig. [T] (left). For this ADTerm, we have r(t) = p. Subterms E and F are basic 



type(vP) = (p fe , P ) 

typeK) = (p fc , P ) 
type(c p ) = (po,p) 



type(V^) = (o fe ,o) 
typc(A°J = (o fc ,o) 
type(c°) = (op,o) 



type(6) = (e,p), for 6 G B p 



type(ft) = (e,o), for b G B°. 
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b = NL° c = L°(0, 1) 

/ \ 

d = LP(0,l) e = LP(l,0) 



Fig. 1. An example of an ADTerm (left) and a two-player binary zero-sum extensive 
form game (right). 

actions of the proponent's type, and G is a basic action of the opponent's type. 
Assuming the proponent is the attacker, this means that the system can be 
attacked by combining the basic attack actions E and F . However the defender 
has the option to defend if he implements the basic defense action G. 

In order to check whether an attack-defense scenario is feasible, we introduce 
the notion of satisfiability of an ADTerm by defining a satisfiability attribute 
sat. First, for player s G {p, o} we define a basic assignment for s as a function 
f3 s : M s — > {true, false}. We gather the basic assignments for both players in a ba- 
sic assignment profile f3 — (/3 P , j3°). Second, the function sat: Ts — > {true, false} 
is used in order to calculate the satisfiability value of an ADTerm. It is defined 
recursively as follows 



For instance, consider the term t from Example [T] and the basic assignment 
profile j3 = (/3 p ,/3°), where /3 P (E) = true, /3 P (F) = true, /3°(G) = false. We get 
sat(i) = true. Assuming the proponent is the attacker, this means that the basic 
defense action G is absent and the system is attacked by combining the basic 
attack actions E and F. 

The next definition formalizes the notion of a satisfiable ADTerm for a player. 

Definition 2. For every player s, strategy /3 s and strategy profile f3, we define 
the sets of AD Terms Sat^, Sat^ s , Sat s C Ts in the following way. Let t G Tg. 

— t G Sat^j if either r(t) = s ands&t(t) = true, orr(t) = — s ands&t(t) — false. 
In this case we say that s is successful in t under /3. 

— t 6 Sat^ s if t s Satfgp for every basic assignment /3~ s . In this case we 
say that s is successful in t under f3 s . 

— t G Sat s if there exists a basic assignment /3 s for player s such that t G Sat^ s . 
In this case we say that t is satisfiable for s. 



sat(t) 



I3 s (t s ), iff 

V(sat(ti), . . . ,sat(t fe )), if t 

A(sat(fi), . . . , sat(tfc)), if t 

sat(ti) A ->sat(t2), if t 



t s G V s , 
V s (ti,...,t fc ), 
A s (h,...,t k ), 
c s {t u t 2 ). 



Theorem 1. For every ADTerm t, we have that every basic assignment profile 
fj partitions Ts into Sat? and Sat^ . 

Proof. This follows immediately from the first item in Definition [5J 



2.2 Two-player Binary Zero-sum Extensive Form Games 

We consider two-player binary zero-sum extensive form games, in which a pro- 
ponent p and an opponent o play against each other. In those games, we allow 
only for the outcomes (1,0) and (0,1), where (1,0) means that the proponent 
succeeds in his goal (breaking the system if he is the attacker, keeping the system 
secure if he is the defender), and (0, 1) means that the opponent succeeds. Note 
that the proponent is not necessarily the player who plays first in the game. 
Finally, we restrict ourselves to extensive form games, i.e., games in tree format. 
Our presentation of games differs from the usual one, because we present games 
as terms. This eases the transformation of games into ADTerms. We formalize 
games in the next definition, where L stands for a leaf and NL for a non-leaf of 
the term. 

Definition 3. Let S = {p, o} denote the set of players and Out = {(1, 0), (0, 1)} 
the set of possible outcomes. A two-player binary zero-sum extensive form game 
is a term t ..= ?/> p | ip° , where 

^ P ::=NL P (V> ,...,V°) I L P (1,0) | 17(0,1) 
iP° ::= NL°(V> P , . . . , ip p ) | L°(1,0) | L°(0,1). 

We denote the set of all two-player binary zero-sum extensive form games by 
Q. We define the first player of a game ip s as the function r : Q —> S such that 
t(iP s ) = s. 

Example 2. An example of a two-player binary zero-sum extensive form game is 
the expression NL p (NL°(L p (0, 1), L p (l, 0)), L°(0, 1)). This game is displayed in 
Fig. [1] (right). When displaying extensive form games, we use dashed edges for 
choices made by the proponent, and solid edges for those made by the opponent. 
In this game, first the proponent can pick from two options; if he chooses the 
first option, the opponent can choose between outcomes (0, 1) and (1,0). If the 
proponent chooses the second option, the game will end with outcome (0, 1). 

Definition 4. A function a s is a strategy for a game g E Q for player s S S if 
it assigns to every non-leaf of player s in g NL S (^]~ S , . . . , ip^ 8 ) a term ip~^ s for 
some k S {1, . . . ,n}. 

A strategy profile for a game g £ Q is a pair a — (er p , o~°), where cr p is a strategy 
of g for p, and a° a strategy of g for o. 
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If g = NL S s , . . . , ip n s ) and a — (ct p ,ct°), sometimes we abuse notation and 
write a(g) = ip^ s where ip^ s = <r s (g). 

Now we define the outcome of a game in three steps. 

Definition 5. We say that (0, f ) < p (1, 0) and (f , 0) <° (0, 1), so that (Out, < p ) 
and (Out, <°) are totally ordered sets. Let (r p ,r°) be an element of Out, and 
tpi' s 7 . . . , ipn s be games with player — s as the first player. 

1. The outcome out( .p iCT o) : Q — > Out of a game g under strategy profile a = 
(ct p ,ct°) is defined by: 

out {aPta o ) (L s (rP,r°)) = (r*,r°) 
out (ff p !(T o ) (NL s (V'r s , • ■ • , 4>n S )) = out (CT p ;<T o)(<T s (NL s (V>r s , • • • , 4>n S ))) 

2. The outcome out^s : Q — > Out of a game g under strategy a s is defined by: 

ouW(I/(r p ,r°)) = (r p ,r°) 
out ffS (NL s Wr*, • • • , VC)) - out^^^NL'^r', . . . , VC))) 
out ffS (NL- s (?A 1 - s ,...,^ s )) - max < - a {out (jS (^ s )} 

l<i<n 

3. The outcome out : Q — \ Out of a game g is defined by: 

out(L s (r p ,r°)) = (r p ,r°) 
out(NI/W>rV..,Vv s )) = max < S {out CT a (^ s )} 

l<i<n 

out(NL _;s (-0 1 ' s ,...,-0~ s )) = max {out CT e (V'," 8 )} 

l<i<n 

Here out(„ P jJ o) denotes the outcome of the game when p and o play according 
to strategy a p and er°, respectively. Furthermore out CT s denotes the outcome 
if player s plays strategy a s , and player — s tries to achieve the best possible 
outcome for himself. Finally, out denotes the outcome of the game if both players 
try to maximize their own outcome. 



3 Prom Games to ADTerms 



In this section, we show how to transform binary zero-sum two-player extensive 
form games into ADTerms. We define a function that transforms games into 
ADTerms, and a function that transforms a strategy for a game into a basic 
assignment for the corresponding ADTerm. First we show that the player who 
wins the game is also the player for whom the corresponding ADTerm is satis- 
fiable, if both players play the basic assignment corresponding to their strategy 
in the game. Then we show that if a player has a strategy in a game which 
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Fig. 2. Transformation of a game in extensive form into an ADTerm by function [-]ad- 

guarantees him to win, he is successful in the corresponding ADTerm under the 
corresponding basic assignment. For this purpose, we first define a function [-]ad 
that maps games into ADTerms. 

Definition 6. Let v s , u s , and u\, . . . , u s n , for s E S , represent fresh basic actions 
from W . The function [-]ad : Q Ts is defined in the following way. 



L p (1,0)^ w p (la) 

L°(1,0) H4 c°(u°,v p ) (lb) 

L P (0,1) H4 c p (u p ,i>°) (lc) 

L°(0,l)^w° (Id) 



NL P (^, . . . ,il> n ) ^ V p (c p «, [^i]ad), • • ■ , c p «, [^]ad)) (le) 
NL°(^, . . . , i> n ) h> V°(c°K, [^i]ad), ■ ■ ■ ,c°«, Wad))- (If) 

The rules for player p are visualized in Fig. [2] (the rules for player o are symmet- 
ric). The rules specify that a winning leaf for a player in the game is transformed 
into a satisfiable ADTerm for this player, i.e., an ADTerm consisting of only a 
leaf belonging to this player (Rule (fTaj) - (|ld[) ), and that non- leaves in the game 
are transformed into disjunctive ADTerms of the same player (Rule (fTe|) - (fTf]) ). 
These disjunctions have children of the form c s (u p , [V^Iad) for some k. The in- 
tended meaning here is that player s selects u p exactly when his strategy selects 
tpk in the game. An example of a transformation of a game into an ADTerm is 
depicted in Fig. [3] 

The resulting ADTerm is thus conjunction-free. Note that because terms in 
games alternate between p and o, this procedure results in valid ADTerms (i.e., 
in terms of the form c s (u Sl , v S2 ), Si = s and S2 = —s, and disjunctive terms for 
player s have children for player s as well). 

Now we define how to transform a strategy profile for a game into a basic as- 
signment profile for an ADTerm. First we define a transformation [-Jad from 
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NL P 



E = NL° 



NL P 
/ \ 



F = NL° 



G = NL P 



NL° 



NL P 1^(0,1) L p (l,0) 




L°(1,0) L°(0,1) L°(1,0) L°(0,1) 



Fig. 3. The result of the transformation of the ADTerm from Fig. Q] into a game (left), 
and the game from Fig. [1] into an ADTerm (right). 



a strategy a s (s € {p,o}) for game g into a basic assignment /3 s = [it s ]ad 
for ADTerm [3] ad- Intuitively, if a player's strategy for the game selects a cer- 
tain branch, the basic assignment for the ADTerm assigns true to the node Uk 
in the corresponding branch, and false to the nodes Uk in the other branches. 
Furthermore, ADTcrms resulting from leaves in the game are always selected. 

Definition 7. Let s be a player, g be a game and a s be a strategy of player 
s for g. The function /3 s = [ct s ]]ad is defined as follows. For all ADTerms 
c s (u s ,v~ s ) and v s resulting from the first four cases in Definition® we set 
(3 s (u s ) = fi s (v s ) — true. For ADTerms obtained from game g by one of the last 
two cases in Definition® if<? s (g) = V'fej we setj3 s {u s k ) — true and/3 s (uf) = false 
for 1 < i < n, i k. 

The strategy profile (/3 p ,/3°) can be transformed into a basic assignment profile 
by [(/3p,£°)]ad = ([/? p Iad, [8°1ad). 



The next theorem states that a player is the winner in a game under a certain 
strategy profile if and only if he is successful in the corresponding ADTerm under 
the basic assignment profile corresponding to the strategy profile. 

Theorem 2. Let g be a game and a a strategy profile for g. Then out (T (g) = 
(1,0) if and only if [3] ad £ Satjj 1 ^ . 

The following theorem states that a strategy in a game guarantees player s to 
win if and only if s is successful in the corresponding ADTerm under the corre- 
sponding basic assignment. Surprisingly, this is not a consequence of Theorem[2j 
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there might be a basic assignment /3 s for the ADTerm, for which there exists 
no strategy a s such that (3 s = [ct s Jad (i-e, the function [-]ad is not surjective). 
Therefore it is not immediately clear that if a player has a strategy er s that wins 
from the other player independent of his strategy, a player with a basic assign- 
ment [<t s ]ad wins from the other player independent of his basic assignment. 

Theorem 3. Let g be a game and o~ p be a strategy for p on g. Then outo-p^) = 
(1,0) if and only if [g] Art £ Sat^^ . 

Now we obtain immediately the following corollary by definition of out and Sat p . 
Corollary 1. Whenever g is a game, out(<7) = (1,0) if and only «/[.9]ad £ Sat p . 

4 Prom ADTerms to Games 

We proceed with the transformation in the other direction. We define two trans- 
formations, namely from ADTerms into games, and from basic assignment pro- 
files into strategy profiles. Then we show that if a player has a basic assignment 
for an ADTerm with which he is successful, the corresponding strategy in the 
corresponding game guarantees him to win. 

Definition 8. We define a function [-]q from ADTerms to games as follows: 





v p M> NL°(NL p (L°(0, 1), L°(l, 0))) 


(2a) 




V° H> NL P (NL°(L P (1, 0), L p (0, 1))) 


(2b) 


v p 0Ai, 


...,V„)^NL°(NL p ([^i]g,...,[^]g)) 


(2c) 


v°(Vi, 


...,^)^NL p (NL°([^i] G ,...,[V'r l ]G)) 


(2d) 




. . . , V„) NL°(NL p ([^i]g), • • . ,NL p ([^„] G )) 


(2e) 


A°(Vi, 


. . . , V„) H- NL p (NL°([^i]g), • • • , NL ([^„]g)) 


(2f) 


c p 


(Vi> 2 )^NL°(NL p ([ ? A 1 ]g),[V'2]g) 


(2g) 


c° 


(Vi>2)^NL p (NL°([V-i]g),[V'2]g) 


(2h) 



A graphical representation of the rules for player p is displayed in Fig. 0] (the 
rules for player o are symmetric). It can easily be checked that this construction 
guarantees valid games (in which p-moves and o- moves alternate). According 
to these rules, we transform leaves for player s into two options for player s, a 
losing and a winning one (Rules (PZaT) and (|2b[0 . These choices correspond to not 
choosing and choosing the leaf in the ADTerm, respectively. Disjunctive terms 
for player s are transformed into choices for player s in the game (Rules (I2cl) 
and (|2dl0 . There is no direct way of representing conjunctions in games. We can 
still handle conjunctive terms though, by transforming them into choices for the 
other player (Rules (|2e| and ((2f|). This reflects the fact that a player can succeed 
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Fig. 4. Transformation of an ADTerm into a game by means of function [-Jo- 



in all his options exactly when there is no way for the other player to pick an 
option which allows him to succeed. Finally, countermeasures against player s 
are transformed into a choice for player — s (Rules Pg| ) and (|2h[) ). Here, the first 
option corresponds to player — s not choosing the countermeasure, so that it is 
up to player s whether he succeeds or not, while the second option corresponds 
to player — s choosing the countermeasure. 



The transformation of a game into an ADTerm is illustrated in Fig. [3] 



We proceed by defining a transformation |-]g from a basic assignment for an 
ADTerm into a strategy for the corresponding game. We only give the definition 
for s — p; the definition for s = o is symmetric. 



Definition 9. Function [-Jg is a transformation from a basic assignment /3 P 
for ADTerm t into a strategy a p — [/3 p ]]g for the game [ijc- If a (sub)term from 
[£]g is obtained by rule (2n) in Definition^ then o~ p of that (sub)term is defined 
by rule (3n) in this definition. 
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(3a) 



(3c) 



= [^i]g 

if there exists no such number. 



For 



<7P(NLP(NL°([V>i] G ), • • • , NL°([^„] G ))) = NL°([^] G ) 

where k is the smallest number such that ipk G Sat? 



(3f) 




(3h) 



Rules (3b), (3d), (3e) and (3g), cr p is trivially defined as there is only one re- 
finement. 

Note that some of the rules, namely Rules (3c), (3f) and (3h), are non-local in 
the sense that we need to evaluate all subterms of the ADTerm before we can 
decide what to play in the game. 

Theorem 4. Let t be an ADTerm and (3 P a basic assignment for t. Then t <E 
Sat^p if and only i/out[ (3P j G ([t] G ) = (1,0). 

Now the definition of out and Sat p gives us the following corollary. 
Corollary 2. Whenever t is an ADTerm, t e Sat p if and only i/out([i] G ) = 



5 Conclusion 

We showed that attack-defense terms and binary zero-sum two-player extensive 
form games have equivalent expressive power when considering satisfiability, in 
the sense that they can be converted into each other while preserving their out- 
come. Moreover, the transformations preserved internal structure, in the sense 
that there exists injections between subterms in the game and subterms in the 
ADTerm such that if a player wins in the subterm of the game, the correspond- 
ing subterm in the ADerm is satisfiable for this player, and vice versa. Therefore 
attack-defense trees with a satisfiability attribute and binary zero-sum two- 
player extensive form games can be seen as two different representations of the 
same concept. Both representations have their advantages. On the one hand, 
attack-defense trees are more intuitive, because conjunctions and refinements 
can be explicitly modeled. On the other hand, the game theory representation 
profits from the well-studied theoretical properties of games. 

We saw that two notions in the domain of ADTerms had no direct correspon- 
dence to notions in the world of games: conjunctive nodes and refinements. The 



(1,0). 
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first problem has been solved by transforming conjunctive nodes for one player 
to disjunctive nodes for the other player. This also shows that, when considering 
the satisfiability attribute, the class of conjunction-free ADTerms has equal ex- 
pressive power to the full class of ADTerms (note that the transformation from 
ADTerms into games and vice versa are not each other's inverse, i.e., [[£]ad]g 7^ t 
and [[£]g]ad 7^ t)- The second problem has been solved by adding extra dummy 
moves with only one option for the other player in between refining and refined 
nodes. 

In the future, we plan to consider attack-defense trees accompanied with more 
sophisticated attributes, such that a larger class of games can be converted. An 
example of these are non-zero-sum games, where (1, 1) can be interpreted as an 
outcome where both the attacker and the defender profit (for example, if the 
attacker buys his goal from the defender), and (0,0) as an outcome where both 
parties are damaged (when the attacker fails in his goal, but his efforts damage 
the defender in some way). Also the binary requirement can be lifted, so that 
the outcome of a player represents for instance the cost or gain of his actions. 
Furthermore, it would be interesting to look for a correspondence of incomplete 
and imperfect information in attack-defense trees. 
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A Appendix: proofs 



Proof (Theorem^). Let g be a game and a a strategy profile for g. We set 
t = [g] ad and /3 = [cr] ad- We prove the theorem by structural induction on 
term g. 

In the base case, g = L s (r p ,r°) with r p , r° G {0, 1}. If out CT (#) = (1, 0), r p = 1 
and r° = 0, so either t — v p or t = c°(u°,v p ). In the first case, sat(v p ) = true 
by definition of g, so sat(i) = true and therefore i 6 Sat^. In the second case, 
sat(w°) = sat(w p ) = true by definition of g, so sat(£) = sat(c°(u°, v p j) — false. 
Therefore t £ Sat^ and thus t G Sat}^. If out ff (g) ^ (1,0), omvfo) = (0, 1), and 
by symmetry t G Sat°j and thus t g 1 Sat^J. 

We proceed with the induction step. We first give the proof that out a (g) = (1,0) 
implies t G Sat^. We assume out<j(g) = (1,0). Then g — NL s (^i, tp n ), so 
t = V s (c s (uf , [^>i]ad)), • ■ • , c s (w^, [VViJad)- Furthermore, there exists a k such 
that ipf. — <j(g). Therefore o\xt a {i^k) = (1,0). By induction hypothesis, [?/>fc]AD G 
Sat^. Now assume s = p, so riipk) = o by the definition of a game. Then 
t([^/ c ]ad) = o by definition of [-]ad, so sa,t([ipk}Ar>) = false by Definition [5] and 
sat(w^) = true by definition of g. Therefore sat(c p (u^, [^ad)) = true, and 
therefore sat(t) = sat(V s (c s (uf , [V>i]ad)> • ■ • , c s (u^, [V^Ad)) = true. Because it 
holds that r(t) = r(g) = p, we have t G Sat?. 

Now assume s = o, so r(V'fc) = p by the definition of a game. Then t^t^ad) = P 
by definition of [-]ad, so sat ([^/c] ad) = true by Definition [5] Therefore it holds 
that sat(c p (it£, [V>A;]ad)) = false. Furthermore, whenever l<s<n, s^fc 
sat(w s ) = false by definition of g, and therefore sat(c p (w p , [^]ad)) = false. This 
means that sat(t) = sat( V°(c°(u°, [V'iIad), ■ • ■ , c°(it°, [V^ad))) = false. Because 
r(t) = r(g) = o, t Sat^ and therefore t G SatS. 

Now we show that t G Sat? implies out a (g) — (1,0). We have that out a (g) = 
(0, 1) implies t G Sat°j by symmetry. Then we also have out a (g) ^ (0, 1) implies 
t ^ Sat^ by Theorem [TJ Then we have t G Sat^ implies out^g) = (0,1) by 
contraposition. 

Proof (Theorem^). Again we prove this by structural induction on the game. 
Let t — [<?]ad and (3 P = [ct p ]ad be a basic assignment. 

The base case is the same as in Theorem [2j so we just show the induction 
step. First we prove that out CT p(g) = (1,0) implies [<?]ad £ ^ at [o-p] AD - We as- 
sume outcrp(g) = (1,0). Then g — NL s ((-0i, ip n )), so we have that t = 
V s (c s (wf , [?/>i]ad), . . . , c s (Un, [V^ad))- Now assume s — p. Then there exists 
a k such that ipk — & p (g). Therefore out,^ = (1,0). By induction hypothesis, 
[V'fcjAD G Sat^p. Since we have s = p, rfyk) — o by the definition of a game. 
Then t([^]ad) = o by definition of [-]ad, so sat([?/>fc]AD) = false by Definition [2] 
and sat(M? ) = true by definition of g. Therefore sat(c p (u?, [V^Iad)) = true, and 
therefore sat(t) = sat(V s (c"(uf , [V>i]ad), • ■ • , cS ( u ni Wad)) = true. Since we 
have r(t) = r(g) = p, t G Sat^ p . 
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Now assume s = o. Assume 1 < k < n. Then out^j. = (0, 1), so [V'sJad £ Sat^ p 
by induction hypothesis. Furthermore, by s — o, rtyk) — p by the definition 
of a game. Then t([i/)j;]ad) = P by definition of [-]ad, so sat([/i/>/c]AD) = in/e 
by Definition O Therefore sat(c p (w^, [V'/cJad)) = false, so we have that sat(i) = 
sat(V°(c°(u?, [-0i]ad), • ■ • ,c°«, [-0™]ad))) = false. Because r(t) = r(g) = o, 
t g" Sat^o and therefore t E Sat^ p . 

We can prove in a similar way that out aP (g) ^ (1,0) implies [g] ad ^ ^ a '[jp] AD ' 
and from this we can prove that [(?]ad £ Satf/SjjAD implies outo-o(^) = (1,0) by 
contraposition. 

Proof ( Corollary^. It holds that out(g) = (1,0) if and only if there is a strategy 
cr p for p such that out CTP = (1, 0). This holds if and only if t E Sat p p for some /3 P 
by Theorem [3] This in turn is equivalent to t E Sat p . 

Proof (Theorem^. Let g be [t]c- First assume that t E Sato p . We prove by 
structural induction on the ADTerm that out CT p(<7) = (1,0). We will treat the 
different cases according to the transformations in Definition [FJ which all have 
the form t H> g; the first two cases are the base cases, the rest of the cases form 
the induction step. Note that because of t E Sat p p , r(t) — p implies sat(i) = true 
and r(t) = o implies sat(t) = false. 

(3a) vP ^ NL°(NL P (L°(0,1),L°(1,0))). Because sat(t) = true, (3 p (v) = true 
as well, so cr p (NL p (L°(l, 0), L°(0, 1))) = L°(1,0) by Definition [9] Therefore 
out aP (g) = (1,0). 

(3b) v° ^ NL p (NL°(L p (l,0),L p (0,l))). There exists a basic assignment (3° such 
that t ^ Sat p ^ p p a y namely when j3°(t) = true. Therefore t ^ Sat p p , which is 
a contradiction, so we don't need to consider this case. 

(3c) V p (?Ai, . . . ,V>n) H> NL°(NL p ([?Ai] G , . . . , [V>n]c)). Since sat(i) = true, there 
is a j such that sat(-0j) = true. Let k be the smallest number with this 
property. Then ijj k £ Sat p p , so cr p (NL p ([V>i] G , • • • , hMc)) = [V>*]g. Further- 
more, by ipk E Sat o p , we have out CT p ([^fejc) = (1>0) by induction hypothesis. 
Therefore outo-p^) = (1,0). 

(3d) V°(^, • • • , Vn) NL p (NL°([^ 1 ] G , . . . , [^„] G )). By t E Sat p p we have that 
sat(i) = false, so for 1 < fc < n, sat(^fc) = false. Furthermore, because 
T(ipk) = o, it holds that ipk E Sat p p . By induction hypothesis, it holds that 
out^aV^c) = (TO), so out CTP ( 5 ) = out trP (NL p (NL ([^ 1 ] G ,...,[V'„]G))) = 
(1,0). 

(3e) A p (-0i, ■ • ■ , tpn) ^ NL°(NL p ([^ 1 ] g ),...,NL p ([V'„]g)). Assume 1 < k < n. 
By sat(i) = false we obtain sat(ipk) = true and because r(-0fc) = P, tpk S 
Sat p p . By induction hypothesis, out CTP ([-0A;]g) = (1,0), so we have that 
out (TP (NL p (['0fc]G)) = (1,0) for 1 < k < n, and therefore ouUfg) = (1,0). 

(3f) A°(^i, ■ • ■ , ip n ) NL p (NL°([^i]g),---,NL°([^„]g))- Because sat(f) = false, 
there is a number j such that s&t(ipj) = false. Let k be the smallest num- 
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ber which this property. Then a p (t) = NL ([^]g). Furthermore, by ipk £ 
Sat p p , we have out CT p ([V^lc) = (1,0) by induction hypothesis. Therefore 
out tT p(«7/ c )) = (1,0) for 1 < fc < n, so out <J p(g) = (1,0). 

(3g) c p (-0i, 1P2) ^ NL°(NL p ([^i] G ), Wg). By sat(t) = true, we obtain sat(^i) = 
true and sat (^2) = false. Because we have t(V>i) = p and t(i/>2) = o, both 
ipi £ Sat^ p and ip2 £ Sat p p . Then by induction hypothesis, out CT p ([V>i]g) = 
out .p([V> 2 ]G) = (1,0). Then out CTP (NL p ([f/>i] G )) = size(l,0) as well, and 
therefore outo-p(gf) = (1,0). 

(3h) c°(-0i, 1P2) i-> NL p (NL°([^i]g), Wg). Because we have sat(i) = /a/se, either 
sat(V'i) = false or sat (^2) = true. In the first case, a p (t) — [^iJg- Moreover, 
by t(V>i) = o, xpi £ Satop, so out cr p([^i]G) = (1,0) by induction hypothesis. 
Then out ffP (t) = (1,0) as well. In the second case, a p (t) = NL°([^i]g). Fur- 
thermore, by r(tp2) — P, we have ip2 £ Sat p p , which implies out<j P (["02]g) 
: 1 . 0) by induction hypothesis. Then out CT p (g) = o\it aP (NL°([^i]g)) = (1,0). 

In a similar way, we can prove that t $ Sat p p implies out CT p(g) ^ (1,0), which 
gives us by contraposition that out aP (g) = (1,0) implies t £ Sat p p . 

Proof (Corollary^. It holds that t £ Sat p if and only if * £ SatL for some /3 P . 
This holds if and only if there is a strategy tr p for p such that out CTP = (1,0) by 
Theorem |U This in turn is equivalent to out (g) = (1,0). 
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